Estimating the Sensitivity of Enterprise Data

Abstract

A method for evaluating data includes defining a list of data categories, determining a relative sensitivity to each data category, determining one or more classifiers for each of the data categories, receiving a plurality of data items to be valued, determining one of the data categories for each of said plurality of data items according to the one or more classifiers, and determining a respective sensitivity for each of said plurality of data items.

1 - 19 . (canceled) 
     
     
         20 . A computer readable storage medium embodying instructions executed by a processor to perform a method for estimating the sensitivity of data comprising:
 defining a plurality of data categories;   determining a relative sensitivity of each of the data categories;   receiving one or more classifiers for associating data items with one or more of the data categories;   receiving a plurality of data items to be valued;   associating one or more of the data categories with each of the data items; and   determining a respective sensitivity for each of the data items according to the relative sensitivity of associated data categories.   
     
     
         21 . The computer readable storage medium of  claim 20 , wherein determining the relative sensitivity of the data categories further comprises executing an interview tool. 
     
     
         22 . The computer readable storage medium of  claim 20 , wherein determining the relative sensitivity of the data categories further comprises:
 receiving a rank-order of the data categories;   combining the rank orders of the data categories to create an overall rank order; and   receiving an assignment of a relative score to each of the data categories in the overall rank order of the data categories.   
     
     
         23 . The computer readable storage medium of  claim 20 , wherein receiving the data items to be valued further comprises at least one of crawling a plurality of files on a plurality of computer systems and receiving a plurality of files via network communications. 
     
     
         24 . The computer readable storage medium of  claim 20 , wherein receiving the data items to be valued further comprises prioritizing the data items. 
     
     
         25 . The computer readable storage medium of  claim 24 , wherein prioritizing the data items further comprises:
 collecting metadata information from the plurality of input data items; and   removing from the plurality of input data items those data items where the metadata does not match one or more of a plurality of predetermined metadata values.   
     
     
         26 . The computer readable storage medium of  claim 24 , wherein prioritizing the data items further comprises selecting ones of the input data items having sensitivities within a preselected range. 
     
     
         27 . The computer readable storage medium of  claim 24 , wherein prioritizing the data items further comprises:
 selecting processes in a target organization; and   utilizing the subset of the input data items related to the selected processes.   
     
     
         28 . The computer readable storage medium of  claim 27 , wherein selecting the processes in the target organization further comprises discovering processes from activity logs corresponding to the selected process. 
     
     
         29 . The computer readable storage medium of  claim 27 , wherein selecting the processes in the target organization further comprises determining a sensitivity level of a process of a target organization by applying a graph analysis using at least one of a number of in-degree links to a process node of the process, a number of out-degree links from the process node of the process, a frequency of the process being executed, job roles in the process, the data categories used in the process or generated by the process, physical location of the data items used in the processes, and a current security level of the data items used in the process. 
     
     
         30 . The computer readable storage medium of  claim 24 , wherein prioritizing the data items further comprises mining processes of a target organization, relationships between the processes and data resources used in the processes. 
     
     
         31 . The computer readable storage medium of  claim 24 , wherein prioritizing of the data items further comprises:
 determining the categories of the data items according to the one or more classifiers identifying the content category of the data item; and   discarding data items not belonging to a predetermined set of categories.   
     
     
         32 . The computer readable storage medium of  claim 20 , wherein determining the sensitivity for each of the data items further comprises at least one of estimating data sensitivity based on metadata information of each data item, estimating the data sensitivity based on the business processes involving the data items, and estimating the data sensitivity based on the content of the data item. 
     
     
         33 . The computer readable storage medium of  claim 20 , the method further comprising:
 applying the one or more classifiers to the data items;   counting a number of occurrences of each of the data categories found in each of the data items;   determining the respective sensitivities of the data items with respect to the data category based on the number of occurrences and the sensitivity of each of the data categories found in the data items; and   setting an aggregated sensitivity value as the sensitivity of the data items.   
     
     
         34 . The computer readable storage medium of  claim 33 , the method further comprising normalizing the sensitivity for each of the data categories into the same range of values. 
     
     
         35 . The computer readable storage medium of  claim 32 , wherein estimating the data sensitivity based on the business processes further comprises:
 determining a sensitivity of each of a plurality of processes consuming the data items; and   determining the respective sensitivity for each of the data items according to the sensitivity of the process determined for each of the data items.   
     
     
         36 . The computer readable storage medium of  claim 35 , further comprising:
 determining a relationship among the processes according to dependencies among the processes; and   updating the sensitivity of at least one process according to dependencies among the plurality of processes.   
     
     
         37 . The computer readable storage medium of  claim 32 , wherein estimating the data sensitivity based on the metadata information further comprises:
 determining the sensitivities of the metadata of the data items; and   determining the respective sensitivity for each of the data items according to the sensitivities of the metadata information.   
     
     
         38 . A system for evaluating data comprising:
 a memory device storing a plurality of instructions embodying the system for evaluating data; and   a processor for receiving a plurality of data items to be valued and a plurality of data categories and executing the plurality of instructions to perform a method comprising:
 determining a relative sensitivity of each of the data categories; 
 receiving one or more classifiers for associating data items with one or more of the data categories; 
 receiving a plurality of data items to be valued; 
 associating one or more of the data categories with each of the data items; and 
 determining a respective sensitivity for each of the data items according to the relative sensitivity of associated data categories. 
   
     
     
         39 . A method in a computer system for generating estimates for sensitivity of data, the method comprising:
 defining a plurality of data categories;   determining a relative sensitivity of each of the data categories;   receiving one or more classifiers for associating data items with one or more of the data categories;   receiving a plurality of data items to be valued;   associating one or more of the data categories with each of the data items; and   determining a respective sensitivity for each of the data items according to the relative sensitivity of associated data categories.   
     
     
         40 . The method of  claim 39 , wherein assigning the relative sensitivity to each of the data categories further comprises:
 receiving a rank-order of the data categories;   combining the rank orders of the data categories to create an overall rank order; and   receiving an assignment of a relative score to each of the data categories in the overall rank order of the data categories.